Stolen UpdraftCentral Keys Put WordPress Sites At Risk, While The Fix Has A Gap

🔍 Read the full analysis: Stolen UpdraftCentral Keys Put WordPress Sites At Risk, While The Fix Has A Gap on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said on October 19, 2026, that attackers had accessed its website over the preceding weekend and likely reached a customer database containing keys for UpdraftCentral Cloud, its remote WordPress management service. Security researchers report that attackers used the keys to install backdoor plugins on WordPress sites; the available fix, UpdraftPlus 1.26.13, revokes some exposed keys but does not remove backdoors already installed.

In its incident notice, TeamUpdraft said the database may have included customers’ names, email and billing addresses, order histories, hashed passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said payment-card data was not held in the database because Stripe and PayPal process payments. It also said backups stored directly with services such as Google Drive, Dropbox or Amazon S3 were not affected. For sites connected through UpdraftCentral, however, TeamUpdraft recommends reauthorizing storage and changing related access keys.

TeamUpdraft said it closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated payment-provider keys. It reported the incident to the UK Information Commissioner’s Office. The company said the UpdraftPlus plugin downloads and self-hosted UpdraftCentral were not affected. Those statements do not mean connected WordPress sites are clear: the cloud connection keys could authorize commands on sites that had been linked to the service.

Patchstack’s analysis says attackers used the command plugin.upload_plugin to upload and activate malicious plugins. It counted 99 plugin names used between the afternoon of October 18 and 09:23 on October 19. A recurring plugin description was “Small maintenance toolkit: keeps option storage tidy.” Researchers say the backdoor could create an attacker-controlled account with elevated capabilities and allow access through a persistent cookie. Removing the plugin alone may not remove that account, and some variants reportedly hide from the WordPress plugin list.

Why Key Revocation Is Not Cleanup

The incident shows why a compromised management credential can put fully patched sites at risk without a flaw in the site’s software. UpdraftCentral-connected sites accept commands signed with their connection key, according to the researchers’ technical analyses. If attackers obtained legitimate keys, the commands could pass the plugin’s normal checks. Updating the plugin is necessary to address exposed credentials, but it is not proof that a site has not been changed.

For site owners, the distinction is practical: revoking a key prevents its future use, while an already-installed backdoor may remain and provide another route into the site. TeamUpdraft has not reported how many customers or websites were affected. Researchers’ findings establish that malicious plugins were deployed, but not the full scale of the incident or the number of sites still compromised.

Owners should check whether their site was connected to UpdraftCentral, follow the vendor’s current incident guidance, and inspect for the indicators described by Patchstack and Nethemba. A suspected backdoor warrants treating the site as compromised rather than assuming that a routine plugin update has restored it. The right response may include removing malicious files and unauthorized accounts, rotating credentials, and reviewing the site for further changes, using trusted incident-response guidance.

How the Keys Reached Connected Sites

UpdraftPlus includes a client for UpdraftCentral, which allows users to manage multiple WordPress sites from a hosted dashboard. Once a site is connected, a valid key authorizes commands according to the permissions of the user who created it. Nethemba and Patchstack say the attackers used genuine dashboard keys, rather than exploiting a software vulnerability to forge them. Their analyses say sites running the latest plugin version could still be affected if they had an exposed key.

Nethemba reported finding the attack on three of its own sites and said it traced the activity to keys exposed from the UpdraftCentral Cloud environment. It also said it ruled out modified plugin code, weak cryptography and an older key-forgery issue, CVE-2026-10795, which it says was fixed in June in version 1.26.5. Nethemba reported that keys created in November 2025 were used after the breach, indicating that at least some keys did not expire automatically. It also noted that the connection option is checked by default when linking a TeamUpdraft account in UpdraftPlus settings; it said the Premium version behaves similarly.

The first key-revocation release, UpdraftPlus 1.26.12, was issued on October 19. Nethemba found that a bug prevented it from deleting keys. TeamUpdraft followed with version 1.26.13, whose changelog says it correctly applies the revocation. Nethemba’s review says that release deletes keys created before 12:07 UTC on October 18, but leaves keys created from 12:07 to 21:00 UTC that day for manual deletion. TeamUpdraft’s stated cutoff is 22:00 British Summer Time, or 21:00 UTC.

““Properly apply the revocation in 1.26.12.””

— TeamUpdraft

Scope and Site Status Remain Unknown

TeamUpdraft has not disclosed how many customers, keys or WordPress sites were affected, or whether the accessed database was copied in full. The company’s statement that it believes attackers reached the database describes its current assessment; the supplied information does not establish the precise amount of data taken or how it was used. It is also unclear how many sites received a backdoor and how many remain accessible to attackers.

Key revocation has limits. According to Nethemba, version 1.26.13 does not automatically delete keys created during part of the October 18 window, and site owners may need to identify and remove those manually. Connections created after the cutoff are not revoked by the update. The precise cleanup procedure may change as researchers identify more backdoor variants. Some early variants reportedly caused HTTP 500 errors before checking for their activation token; Nethemba and Patchstack warn against repairing such a plugin, because doing so could allow the backdoor to run. The supplied material does not include a complete list of affected sites or a final incident report.

Check Connections and Remove Backdoors

TeamUpdraft customers should install the applicable UpdraftPlus 1.26.13 release and consult the latest vendor advisory for instructions on checking and deleting any keys outside the revocation window. Sites previously connected to UpdraftCentral should also be reviewed for unfamiliar plugins, accounts and other changes. The vendor recommends reauthorizing storage and rotating access keys for sites that used UpdraftCentral.

If a suspicious plugin or account is found, removing the plugin alone may leave the attacker’s account behind. Researchers’ guidance is to treat a confirmed backdoor as a site compromise and follow updated remediation advice from TeamUpdraft, Patchstack and Nethemba. Owners should monitor those sources for revised indicators and cleanup steps while the investigation continues; TeamUpdraft has not yet provided an affected-site count or a final account of the breach.

Key Questions

Does updating UpdraftPlus remove an installed backdoor?

No. Version 1.26.13 revokes certain keys, but it does not remove a malicious plugin or account already placed on a site. Sites with indicators of compromise need separate investigation and cleanup.

Which UpdraftPlus versions contain the key-revocation fix?

TeamUpdraft released version 1.26.13 in free and Premium editions after version 1.26.12 failed to revoke keys, according to Nethemba’s review. Follow the vendor’s current advisory for the applicable release and any further instructions.

Were backups stored in Google Drive or Amazon S3 exposed?

TeamUpdraft said backups stored directly with providers such as Google Drive, Dropbox and Amazon S3 were not affected. It recommends reauthorizing storage and rotating access keys for sites that used UpdraftCentral.

How can a WordPress site owner tell whether a backdoor was installed?

Researchers have identified suspicious plugin names and descriptions, as well as unauthorized accounts, but plugin names can vary and some versions may hide themselves. Check the current Patchstack and Nethemba indicators and the TeamUpdraft advisory; an update alone does not establish that a site is clean.

How many sites were affected?

TeamUpdraft has not disclosed a total for affected customers or WordPress sites. Patchstack reported 99 plugin names used during a specified period, but that count is not a count of affected sites.

Source: ThorstenMeyerAI.com